Why Kafka-UI send two requests to OpenLDAP when login?

[waitspring]

As my title say that, when we login Kafka-UI website, the Kafka-UI server send two requests to OpenLDAP:

• first request is bind to dn="dc=domain,dc=com", and result is tag=97 err=49 text= because of invalid credentials;
• second request is bind to dn="cn=admin,dc=domain,dc=com", and result is tag=97 err=0 text=.

And I cannot login Kafka-UI website because of the first request (I think).

This is my application.yml about LDAP, please help me look for error:

auth:
  type: LDAP
spring:
  ldap:
    urls: ldap://xxx.xxx.xxx.xxx:389
    base: "dc=season,dc=com"
    admin-user: "cn=admin,dc=season,dc=com"
    admin-password: "123"
    user-filter-search-base: "dc=season,dc=com"
    user-filter-search-filter: ""
oauth2:
  ldap:
    activeDirectory: false

[Haarolean]

Hi, can't possibly help you since it's an issue with your specific infra.
We have this compose which works fine with OpenLDAP (docker-openldap-test).
You have to figure out your params on your own.

[waitspring]

Maybe I have find the answer.
Kafka-UI filter LDAP user only by (objectClass=inetOrgPerson) rule, cannot filter LDAP user by other rules, like (objectClass=organizationalPerson). (LDAP user used organizationalPerson template actually)

When we filter LDAP user by (objectClass=organizationalPerson), Kafka-UI report 500 error directly.
Maybe this is a BUG!

[waitspring]

500 error like:

ERROR [boundedElastic-2] o.s.b.a.w.r.e.AbstractErrorWebExceptionHandler: [974988c9-9]  500 Server Error for HTTP POST "/login"
org.springframework.dao.IncorrectResultSizeDataAccessException: Incorrect result size: expected 1, actual 3
	at org.springframework.security.ldap.SpringSecurityLdapTemplate.searchForSingleEntryInternal(SpringSecurityLdapTemplate.java:290)
	Suppressed: reactor.core.publisher.FluxOnAssembly$OnAssemblyException: 
Error has been observed at the following site(s):
	*__checkpoint ⇢ AuthenticationWebFilter [DefaultWebFilterChain]
	*__checkpoint ⇢ ReactorContextWebFilter [DefaultWebFilterChain]
	*__checkpoint ⇢ HttpHeaderWriterWebFilter [DefaultWebFilterChain]
	*__checkpoint ⇢ ServerWebExchangeReactorContextWebFilter [DefaultWebFilterChain]
	*__checkpoint ⇢ org.springframework.security.web.server.WebFilterChainProxy [DefaultWebFilterChain]
	*__checkpoint ⇢ org.springframework.web.filter.reactive.ServerHttpObservationFilter [DefaultWebFilterChain]
	*__checkpoint ⇢ HTTP POST "/login" [ExceptionHandlingWebHandler]
Original Stack Trace:
		at org.springframework.security.ldap.SpringSecurityLdapTemplate.searchForSingleEntryInternal(SpringSecurityLdapTemplate.java:290)
		at org.springframework.security.ldap.SpringSecurityLdapTemplate.lambda$searchForSingleEntry$3(SpringSecurityLdapTemplate.java:260)
		at org.springframework.ldap.core.LdapTemplate.executeWithContext(LdapTemplate.java:827)
		at org.springframework.ldap.core.LdapTemplate.executeReadOnly(LdapTemplate.java:813)
		at org.springframework.security.ldap.SpringSecurityLdapTemplate.searchForSingleEntry(SpringSecurityLdapTemplate.java:260)
		at org.springframework.security.ldap.search.FilterBasedLdapUserSearch.searchForUser(FilterBasedLdapUserSearch.java:100)
		at org.springframework.security.ldap.authentication.BindAuthenticator.authenticate(BindAuthenticator.java:86)
		at org.springframework.security.ldap.authentication.LdapAuthenticationProvider.doAuthentication(LdapAuthenticationProvider.java:174)
		at org.springframework.security.ldap.authentication.AbstractLdapAuthenticationProvider.authenticate(AbstractLdapAuthenticationProvider.java:79)
		at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:182)
		at org.springframework.security.authentication.ReactiveAuthenticationManagerAdapter.doAuthenticate(ReactiveAuthenticationManagerAdapter.java:60)
		at reactor.core.publisher.MonoFlatMap$FlatMapMain.onNext(MonoFlatMap.java:132)
		at reactor.core.publisher.FluxSubscribeOnValue$ScheduledScalar.run(FluxSubscribeOnValue.java:180)
		at reactor.core.scheduler.SchedulerTask.call(SchedulerTask.java:68)
		at reactor.core.scheduler.SchedulerTask.call(SchedulerTask.java:28)
		at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
		at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:304)
		at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
		at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
		at java.base/java.lang.Thread.run(Thread.java:833)

[Haarolean]

That's unlikely, we're not using any custom LDAP authentication mechanisms. We use spring ldap which is quite popular and time-tested.

It seems like you're getting 3 entities found instead of just one.

[waitspring]

@Haarolean The answer is user-filter-search-filter configure.
I guess Kafka-UI just only accept one item by user-filter-search-filter with spring ldap.
If we make the paramter value null, or just make user-filter-search-filter: "(objectClass=inetOrgPerson)", spring ldap package will get many items from LDAP, but Kafka-UI has not any except condition to deel this items so that Kafka-UI return 500 error.

I think this is a bug and means Kafka-UI's LDAP is not strong. Maybe Kafka-UI can return a warning in UI, like "Your user-filter-search-filter is not precision so that we find many users from LDAP." That's better than return 500 code.

[akameclark77]

I use this doc https://github.com/provectus/kafka-ui/blob/master/documentation/compose/ldap.yaml#L20
why login error, please help me

What is the user and password?

[waitspring]

Maybe your LDAP's use uid as the login name ether not cn item, can I get your LDAP configure?

[waitspring]

And you can refer this document.
Like:

# auth:
#   type: "ldap"
# spring:
#   ldap:
#     urls: "ldap://ldap.season.com:389"
#     base: "dc=season,dc=com"
#     admin-user: "cn=admin,dc=season,dc=com"
#     admin-password: "season_4U"
#     user-filter-search-base: "dc=season,dc=com"
#     user-filter-search-filter: "(cn={0})"      # 使用员工条目的 cn 属性匹配登录表单中的第一个字符串, 返回命中结果
# oauth2:
#   ldap:
#     activeDirectory: false